Kam taikomas DORA reglamentas?

DORA nuo 2025 m. sausio 17 d. taikomas finansų įstaigoms: bankams, mokėjimo ir elektroninių pinigų įstaigoms, investicinėms ir draudimo įmonėms, kriptoturto paslaugų teikėjams. Netiesiogiai jis paliečia ir jų IRT paslaugų tiekėjus.

Kuo skiriasi ITGC auditas ir DORA atitikties vertinimas?

ITGC auditas tikrina bendrąsias IT kontroles – prieigas, pakeitimus, operacijas – kurios svarbios finansinių ataskaitų patikimumui. DORA vertinimas platesnis: IRT rizikų valdymas, incidentai, testavimas ir trečiųjų šalių rizika.

Kas yra DORA informacijos registras?

Tai visų sutartinių susitarimų su IRT paslaugų tiekėjais registras, kurį finansų įstaiga privalo tvarkyti ir teikti priežiūros institucijai. Padedame jį sudaryti ir palaikyti.

Kaip užtikrinate auditoriaus nepriklausomumą?

Neaudituojame sistemų ir procesų, kuriuos patys diegėme ar valdome. Audito išvados grindžiamos įrodymais ir pateikiamos tiesiogiai vadovybei ar audito komitetui.

Kiek trunka IT auditas?

Priklauso nuo apimties ir sistemų skaičiaus. Prieš pradedant suderiname audito apimtį, planą ir reikalingų dokumentų sąrašą, kad auditas mažiausiai trikdytų jūsų kasdienį darbą.

IT audit and DORA compliance

For financial institutions and fintech: independent IT general controls (ITGC) and DORA compliance audits, ICT risk and third-party assessments with a clear remediation plan.

For financial institutions and fintech: independent IT general controls (ITGC) and DORA compliance audits, ICT risk and third-party assessments with a clear remediation plan.

What we do

DORA compliance · ITGC audit · ICT risk management

DORA compliance assessment

We assess the ICT risk management framework, incident management, testing and business continuity against DORA requirements.

ITGC audit

We assess access, change management, IT operations and backup controls.

ICT third-party risk

We determine whether the requirements apply to you and prepare an implementation plan and documentation.

Internal IT audit

We perform the IT part of internal audit or complement your internal audit with ICT expertise.

Compliance documentation

We prepare ICT risk management, incident and business continuity documentation.

Process optimisation

We propose how to fix gaps and reduce manual work and disruptions.

When you need us

The most common situations in which financial institutions turn to us.

An inspection is coming up

The supervisor or auditors ask you to demonstrate DORA compliance.

You need an independent assessment

Internal audit lacks ICT expertise or an external view is needed.

Financial audit findings

Your financial auditor has raised findings on IT controls.

How we work

Clear steps – you know what happens at every stage of the audit.

1. Scope

We agree the scope, timeline and applicable requirements.

2. Evidence

We collect policies, procedures and evidence of control operation.

3. Assessment

We test controls and rate findings by risk level.

4. Report

We deliver conclusions, a risk rating and a remediation plan.

Frequently asked questions

Who does DORA apply to?

Since 17 January 2025, DORA applies to financial entities: banks, payment and e-money institutions, investment firms, insurers and crypto-asset service providers. It also indirectly affects their ICT service providers.

What is the difference between an ITGC audit and a DORA compliance assessment?

An ITGC audit tests IT general controls – access, change management, operations – that matter for the reliability of financial reporting. A DORA assessment is broader: ICT risk management, incidents, testing and third-party risk.

What is the DORA register of information?

A register of all contractual arrangements with ICT service providers that a financial entity must maintain and submit to its supervisory authority. We help you build and maintain it.

How do you ensure auditor independence?

We do not audit systems or processes that we implemented or manage ourselves. Audit findings are evidence-based and reported directly to management or the audit committee.

How long does an IT audit take?

It depends on the scope and the number of systems. Before we start, we agree on the audit scope, plan and the list of required documents, so the audit disrupts your daily work as little as possible.

Want more value from your systems?

Let’s talk. Every partnership starts with a conversation and an IT situation review: we get to understand your business, IT strengths and areas for improvement, then propose a realistic action plan with predictable results. We reply within 24 hours.

IT audit and DORA compliance